On July 22, 2026, Balance Coin, a stablecoin operating on the BNB Chain, experienced a dramatic collapse, losing over 99% of its value. This happened because an attacker exploited a flaw in the system that reports prices – called a price oracle – and stole approximately $912,000 worth of bitcoin used as backing for the coin. The attack targeted vaults managed by 42DAO, the group responsible for overseeing the protocol.
Key Takeaways
- An attacker drained $912,000 in BTCB from 42DAO vaults on BNB Chain on July 22, 2026.
- Balance Coin (BLC) fell 99.92%, from near $1 to about $0.000795, per Coinmarketcap data.
- Slowmist and Peckshield confirmed the exploit used a manipulated Median Oracle price feed.
Security firms Peckshield and Slowmist confirmed the exploit within hours of the attack. Peckshield first estimated the loss near $915,000. Slowmist later refined that figure to about $912,000 and published a technical breakdown of how the attacker pulled it off.
Balance Coin (BLC) traded near $0.995 to $1.00 before the attack. Within hours, it fell to roughly $0.0014, then slid further to between $0.0008 and $0.0013 on major trackers. Coinmarketcap later showed a price near an intraday low of $0.000795, a 24-hour decline of 99.92%.
How the Exploit Worked
Balance Protocol runs a collateralized debt system modeled on MakerDAO, now known as Users lock BTCB, the Binance pegged version of bitcoin, into vaults and mint BLC against it. A price oracle tracks the value of that collateral. When the ratio between debt and collateral drops too low, the protocol liquidates the vault.
The attacker exploited a weakness in the Spotter contract, using its ‘poke’ function to manipulate the reported price of BTCB. The system’s price checker didn’t verify this fake price against actual market values. This caused the system to incorrectly identify healthy accounts as failing, triggering liquidations. The ‘Dog’ module automatically seized the collateral from these accounts in one transaction, and the attacker then sold it on Pancakeswap for a profit.
Slowmist called it a single transaction combo that exploited missing price protection and a missing liquidation delay in a Maker style system. No private keys were compromised. The protocol trusted a number it should have questioned.
Analysis of the blockchain shows the attack started with a specific transaction. Investigators identified the attacker’s digital wallet, the contract that was targeted, and two other contracts – Spotter and Dog – involved in the liquidations. They were able to follow the entire process, from the initial fake price information being entered to the final sale on Pancakeswap, revealing how a seemingly normal operation resulted in a $912,000 profit for the attacker.
Several standard safeguards were reportedly missing from the design:
- No price deviation checks against outside markets.
- No maximum drawdown limits on the oracle feed.
- No price floor to catch obviously false readings.
- No delay between a price update and a liquidation.
Market Fallout
Before the attack, Balance Coin had approximately 3.5 million tokens in circulation, making its value around $3.5 million. After the incident, its market value plummeted to about $2,800. In the following 24 hours, trading activity surged to around $103,000 as people sold their tokens and traders tried to profit from the situation.
The token reached its peak value of $1.42 in May 2025, but experienced a significant drop on July 22nd, marking its lowest price ever. So far, 42DAO hasn’t shared any plans to fix the issue or offer support to those who lost funds. The stolen BTCB is still held by the hacker.
Following the incident, trackers observed a surge in activity – thousands of transactions, largely purchases – as speculators tried to capitalize on the token’s price drop, hoping for a recovery or a quick profit. However, these efforts failed to stabilize the token’s value.
Balance Coin’s position on popular cryptocurrency tracking websites fell significantly, landing it among the lowest-ranked coins. Trading activity, which was already low, virtually stopped after the recent attack. According to Coinmarketcap, the number of BLC coins in circulation is based on information provided by the Balance Coin team, and there are over 18,000 people who hold the coin.
Part of a Longer Pattern
Balance Coin is now one of a long list of stablecoins that failed to hold their peg. TerraUSD lost its dollar value in the May 2022 in a collapse that wiped out tens of billions of dollars and dragged its sister token LUNA to near zero. Circle’s USDC briefly de-pegegd in March 2023 after Silicon Valley Bank failed, though it recovered once reserves were confirmed safe. Smaller projects like Iron Finance, Beanstalk, and Acala’s aUSD suffered similar exploit-driven collapses in prior years.
A common way these attacks happen is through price manipulation. Attackers provide incorrect pricing data to a system, which then functions as it should – unfortunately, this moves funds to the attacker before anyone can intervene. Balance Protocol was built similarly to well-known systems like MakerDAO, but didn’t include important safety features that those systems developed over time after experiencing close calls.
Why It Matters
Balance Coin was a relatively small cryptocurrency compared to leading stablecoins such as USDT and USDC. However, incidents like this contribute to a growing trend that regulators and users are carefully monitoring. By 2026, U.S. regulations—specifically the GENIUS Act—will require stablecoin issuers to demonstrate they have sufficient reserves and robust systems capable of handling challenging situations.
Currently, Balance Coin is trading for almost nothing. The Bitcoin used as backing for the coin – which was held using BNB – is now inaccessible by 42DAO, and it’s unclear what the project will do about it.
2026-07-22 23:28